Development record
abcd guard allows a bash -c whose environment carries an exported function (a BASH_FUNC_<name>%% variable, through env): bash imports it at startup, so a function named like the -c command runs a blocker in its body although the -c payload is harmless. Reproduced at main 016c1510a: `env 'BASH_FUNC_true%%=() { pkill node; }' bash -c true` judges allow while `pkill node` blocks. Sibling of the BASH_ENV finding iss-2610090821484829, found in the security-drain-2026-10-09 sweep; kept uncommitted until its fix lands.
issueresolvedmajoriss-2610090925399967
abcd guard allows a bash -c whose environment carries an exported function (a BASH_FUNC_<name>%% variable, through env): bash imports it at startup, so a function named like the -c command runs a blocker in its body although the -c payload is harmless. Reproduced at main 016c1510a: env 'BASH_FUNC_true%%=() { pkill node; }' bash -c true judges allow while pkill node blocks. Sibling of the BASH_ENV finding iss-2610090821484829, found in the security-drain-2026-10-09 sweep; kept uncommitted until its fix lands.
Frontmatter
| id | iss-2610090925399967 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | major |
.abcd/work/issues/resolved/iss-2610090925399967-guard-allows-exported-bash-function-env.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2610090821484829`abcd guard` allows `BASH_ENV=<file> bash -c true`, and non-interactive bash sources that file before `-c`, so a blocker written to the file in the same command runs.